Hello, I’m a new member of the community and I’d like to share my experience with you! I would like to introduce to you some vulnerable plugins that allow sql injection in WordPress, mainly those that are used in very large numbers. We strongly recommend that you check your version of each plugin and update it if you are using a version that has not been fixed.

2000px-SQL_ANATOMY_wiki.svg

What is sql injection?

Simply put, a sql injection is a method by which the contents of a WordPress database (which contains all settings and post data) can be rewritten in a way not originally intended by the program. If a malicious user takes advantage of this sql injection, he/she can rewrite WordPress posts, take away administrative privileges, and even change most of the settings.

There are many plug-ins and themes that are vulnerable to sql injection, and in many cases, the vulnerability has been fixed by version upgrades, so we recommend updating to the latest version if you are using this plug-in.

sql injection in wordpress itself

It has been reported that WordPress 4.3 or lower has a SQL Injection vulnerability in the core files. It is a sanitization-related bug and has been fixed since 4.3

sql injection in plugins

WP Statistics < 12.0.8 300,000 installed

NextGEN Gallery < < 2.1.57 million installs

Ninja Forms < under 2.9.55.2 600,000 installs

All In One WordPress Security and Firewall < under 3.8 400,000 installs

Facebook < under 1.01 100,000 installations

SEO Plugin by Yoast < under 1.7.3.3 3 million installs

WP-Slimstat < under 3.9.5 million installs

You can also check WordPress vulnerabilities here WordPress Vulnerability Assessment Security Scanner

Related Posts:

  1. How to find out if a WordPress plugin is vulnerable for free.
    Learn how to use the WordPress Doctor Malware Scan & Security plugin to scan and examine your plugins for vulnerabilities....
  2. More attacks against vulnerabilities in the plugin Duplicator
    Duplicator, a plugin deployed on millions of sites that allows users to migrate, copy, move, clone, and create backups of WordPress sites, is vulnerable in versions 1.3.26 and below....
  3. WordPress security, prevent SQL injection with HTACCESS
    We will explain how to prevent SQL injection to improve WordPress security....
  4. How to check individual WordPress plugins for vulnerabilities
    Hacking using plug-in vulnerabilities, which account for the majority of WordPress malware infections (tampering damage), has been increasing in recent years. Plug-in vulnerabilities are sometimes fixed by the creators of the plug-ins, so it is advisable to keep all plug-ins up-to-date, but you may hesitate to do so because of the possibility of WordPress malfunctions. If the plugins are repeatedly...
  5. Change WordPress database prefix to prevent SQL injection
    You can reduce the chances of a successful SQL injection by changing the prefix of your WordPress database. We will explain how to do this....
  6. What is a WordPress injection attack?
    There are various methods by which WordPress can be hacked, the most common of which is called an injection attack. This section describes these injection attacks....